They showed a picture of a gun - one read, "you are next", while another, also copied to the police, read, "next it's you".

Social media played a terrifying role in the Christchurch attack - the alleged gunman livestreaming the killing.

Netsafe chief executive, Martin Cocker, said he would "expect Facebook to review everything about their video and livestreaming after this".

Facebook has finally spoken since the attack, telling Newshub the social media giant has no plans to take down its livestreaming service - though will look at the reporting process.

It comes after Prime Minister Jacinda Ardern said it "seems like no brainer" that while a country is on a high terror alert and when the ability to livestream played a key role in the attack, "you would stop that livestreaming capability".

Simon Milner, Facebook's vice president of public policy for Asia Pacific, defended the company by referring to the Prime Minister's own use of the livestreaming service on her social media channels.

"We have seen instances just in the last few days of positive instances of livestreaming, including by your Prime Minister - we believe there are more important issues to look at here," he said.

Facebook insisting it's not livestreaming that's the problem.

"It was the redistribution that was the big issue here in terms of people uploading versions of this horrible content," Milner said.

The video was shared over and over again. And it is still available online with Netsafe still working to take it down.

"There's no question that this video is one of the most disturbing pieces our team's been exposed to," Cocker told Newshub.

It took Facebook a week to post a message directing New Zealanders to support services, with an image showing the 1737 mental health helpline - and only after questions from Newshub.

"Earlier this week we did work with some safety organisations to boost their content on the service," Milner said.

Facebook used audio and image matching software to find and block videos of the attack. But it still found 800 different versions, which evaded the software and were uploaded 300,000 times.

But the sharing all started with that one livestream.

A Twitter spokesperson told Newshub:

"The Twitter Rules prohibit violent threats. We took action shortly after we received the first report on this Tweet, and our teams continue to work proactively to remove violative and illegal content from the service in relation to the Christchurch attack.

"We also continue to cooperate with law enforcement to facilitate their investigations as required. We strongly encourage people on Twitter to report violative and illegal content so we can take action.

"Retweeting or sharing screenshots of this type of content only serves to spread it further and gives it more visibility to more people."